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VISIT PRECIS 

BERNARD BARRIER 

(PHONETIC: bear-NAR bar-BYAY) 
Tech n ica 1 Directo r 
Directorate for External Security (DGSE), France 

PATRICK PAILLOUX 

(PHONETIC : pah-TREEK pie-YOO) 
Director 

National Information Systems Security (ANSSI), France 

12 April 2013 



Guests Arrive at GH2R: 1030 

Technical Presentation and Discussions: (1045-1215) 
D DIR-Hostcd Lunch: (1215-1300) 
NSOC Courtesy Call: (1300-1330) 
NTOC Courtesy Call (1330-1430) 

DIRNSA Courtesy Ca ll: (1430-1500) 

Accompanying Senior fl 



(U) BACKGROUND: 

• (TS 7SI//NF) Mr. Barbier and Mr. Patrick Pailloux will travel to NSA on 12 April 2013 to 
share information regarding May 2012 cyber attacks on the French Presidential network. 
In November 2012. a French magazine revealed information about the attacks and 
accused the U.S. of being responsible. During a January 2013 visit, unbeknownst to FAD 
Desk Officers and 5USLAF. DGSE and ANSSI questioned DIRNSA about the cyber 
attacks and asked about U S involvement DIRNSA denied U S involvement and offered 
NSA's assistance to France in attributing the attacks. Two (2) NSA CSS Threat 
Operations Center (NTOC) Analysts were prepared to travel to Paris in March to provide 
support to the French; DGSE and ANSSI canceled the meeting the day before the team 
was scheduled to depart and instead, requested a visit to NSA on 1 2 April, For this visit, 
Mr. Bub it. i ind Mr. Pailloux will be accompanied by: 
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(U) PURPOSE OF THE VISIT: 

• (TS.''.'SI/.'NF) Mr. Barbier and Mr. Pailloux will present technical details of the cyber 

attacks against the French Presidential network from May 2012, Mr Barbier and Mr 
Pailloux will meet with senior leaders and analysts from NTOC. SID. IAD. and FAD in 
hopes that NSA can help with attribution. 

(U) VISITOR REQUESTED: 

• (S .REL TO USA, FRA) DGSE and ANSSI requests help in attributing the cyber attacks 
against the French Presidential network in May 2012. 

CO CDRTJCDRBDIR GUIDANCE: N/A 

(L)PREP SESSION GUIDANCE: 

• (TS//S1//NF) Prep s ession s are s cheduled for DIRNSA and D DIR on 1 2 April. A 
timeline of events will be prepared that describes the cyber attack, the claims by French 

media, discussions with DIRNSA. and steps NSA has taken to support the Partner. 
(U) NSA CSS REQUESTED: 

• (S 'REL TO USA. FRA) Technical data associated with the cyber attacks against the 
French Presidential network. To date, no advance information has been shared with NSA. 

(U) CYBERCOM REQUESTED: N/A 

(I 1 ) COMMON THREADS: 

• (S .REL TO USA : FRA) Stress the potential value of the NSA-DGSE -ANSSI partnership 
through timely cyber defense exchanges 

(U) KEY TOPIC AREAS: 

• (U. FOUO) Computer Network D ef ense (CND ) 

(U) KEY TAKE A WAYS: 

• (S//REL TO USA, FRA) DIRECTORATE'S ROLE: Recommend DIRNSA 
emphasize the following point: 
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• (S7REL TO USA, FRA) CND C ollaboration: Reiterate the need for continued 
close cooperation on CND efforts and emphasize the importance of DGSE and 
ANSSI collaboration to leverage SIGINTto support CND. 



(U) VISIT FORMAT: 

• (S'V REL USA. FRA) Mr. Barbier and Mr. Pailloux will lead a technical discussion 

relating to the May 2012 cyber attacks against the French Presidential network D DIR. 
will host lunch and Courtesy Calls are scheduled with NSOC. NTOC and DIRNSA. 

• S REL TO USA, FRA) NSA participants include: DIRFA, NTOC DIR. IA DIR. SID 
DIR, SUSLAF, FAD Desk Officers, Analysts, and technical Target experts. 

(U) PREVIOUS VISITS AND RESPECTIVE TOPICS: 

• (S ' REL USA, FRA) Mr. Barbier last \isited NSA in May 2012 for the Strategic 
Planning Conference Mr. Pailloux last visited NSA in February 201 1; this visit focused 
on cyber issues. 

<U) POTENTLAL LANDMINES: 

• (TS.-'SIZ/NF) There is a chance that helping attribute the cyber attacks against the French 

Presidential network may reveal a U.S. ally is responsible. 

• (TS. 'SI NF ) The French have not been forthcoming in sharing technical details of the 
cyber attacks There is suspicion that the information is not being shared prior to the visit 
because the French want to see how NSA responds when they present their findings. 
During the January* 2013 DIRNSA visit to Paris, both DGSE and ANSSI asked GEN 
Alexander about the cyber attacks in an attempt to ascertain whether or not the U.S. was 
responsible for the attacks (as reported in French magazines; At no time was FAD made 
aware that DGSE and ANSSI intended to raise the issue with DIRNSA. 

(U) OTHER INFORMATION: 

• (TS, 'SI NF) TAO confirmed that this was not a TAO operation TAO asked most of 
NSA S close Party Partners whether they were involved (CIA, GCHQ r and CSEC 
were the mostly likely suspects)' everyone has denied involvement. TAO intentionally 
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did not ask cither Mossad or ISNU whether they were involved as France is not an 
approved target for joint discussion. 

• (S. .\MF) After repeated requests tor technical information relating to the cyber attacks (in 
advance of the visit). AN SSI and DGSE have not provided any details. 



(D RECENT PRESS INDICATIONS: 



• (U) The cyber attacks against the French Presidential network took place in May 2012. 
An initial press report from Paris Atlantico, Trench Website Says Turkish Hackers 
Behind Elvsee Cyber Attacks ,"" dated 12 July 20 12. stated it was believed "the attacks 
originated from France's allies" and speculated Turkish hackers with possible links to 
Turkish "intelligence services or government bodies'" might be responsible. No follow-on 
press reports have been seen that place blame on Turkey. A press report from Paris 
L 'Express, " French Weekly Reports on Alleged US Cyber Espionage Attack on Elvsee 
Palace / dated 20 November 2012. shifted blame for the attacks toward the United States, 
On 2? November 2012. @rretsur images contacted the Paris L 'Express author who 
shared there are an "'array of assumptions" that enable pointing to the United States as the 
origin of this attack. Paris L 'Express contacted ANSSI and the Ely sec; both declined to 
comment. 
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